CVE-2026-48067

{
  "id": "CVE-2026-48067",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T22:16:46.480",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions  4.11.4 and 5.6.4 and filament/tables 3.3.51."
    },
    {
      "lang": "es",
      "value": "Filament es una colección de componentes full-stack para el desarrollo acelerado de Laravel. Desde filament/actions 4.0.0 hasta 4.11.4 y 5.6.4 y desde filament/tables 3.0.0 hasta 3.3.51, el método recordSelectOptionsQuery() puede usarse para limitar el alcance de las opciones disponibles en el campo Select para AttachAction y AssociateAction. Sin embargo, la regla de validación incorporada para estos campos no aplicaba el mismo alcance. Como resultado, un usuario que puede activar estas acciones podría manipular el estado del componente Livewire y enviar un valor fuera de alcance. Esta vulnerabilidad está corregida en filament/actions 4.11.4 y 5.6.4 y filament/tables 3.3.51."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "filamentphp",
          "product": "filament",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.11.4",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.6.4",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0, < 3.3.51",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T14:29:10.944113Z",
          "id": "CVE-2026-48067",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr",
      "source": "[email protected]"
    }
  ]
}